Return
-
Title
Group memberships are not complete, users cannot login. -
Description
Group memberships are not complete. This issue can be complicated further by the use of the "/etc/opt/quest/vas/vas.conf" setting, user-hide-if -denied. With this set users could be prevented from logging in. -
Cause
There isn't a Global Catalog (GC) Server in the joined site. This particular issue was seen in a Disaster Recovery (DR) scenario where there was only one Domain Controller (DC) in the site however the DC was not a GC which is required as the GC server provides universal group membership information. This combined with the use of hide-if-denied prevented users from logging in as their memberships in the ACL groups defined in "/etc/opt/quest/vas/users.allow" were not processed and therefore the users were not seen as legitimate accounts. -
Resolution
Confirm that the joined site contains a GC and if it does not promote a DC to a GC and reboot.
#/opt/quest/bin/vastool info cldap <domain>
Look for GC in the Flags output. For example:
Flags: PDC GC LDAP DS KDC TIMESERV CLOSE_SITE WRITABLE GTIMESE